nerdexam
CompTIA

SK0-004 · Question #929

A server recently suffered a malware attack. During forensic analysis, it was found that the vulnerability had been on the server all along. The malware finally rendered the server inoperative when…

The correct answer is A. Privilege escalation occurred when the administrator logged in. Dormant malware can lie inactive on a server until a privileged account authenticates, at which point privilege escalation grants the malware the elevated rights needed to execute and cause damage.

Security and disaster recovery

Question

A server recently suffered a malware attack. During forensic analysis, it was found that the vulnerability had been on the server all along. The malware finally rendered the server inoperative when a systems administrator logged onto the server to view setting. Which of the following could have triggered the attack?

Options

  • APrivilege escalation occurred when the administrator logged in.
  • BThe systems administrator used a malware-infected site.
  • CA user kicked off the malware attack remotely to the server.
  • DThe company did not renew the malware license.

How the community answered

(28 responses)
  • A
    68% (19)
  • B
    11% (3)
  • C
    18% (5)
  • D
    4% (1)

Why each option

Dormant malware can lie inactive on a server until a privileged account authenticates, at which point privilege escalation grants the malware the elevated rights needed to execute and cause damage.

APrivilege escalation occurred when the administrator logged in.Correct

Privilege escalation is the technique by which malware or a process gains access rights beyond what it was originally granted. When the systems administrator logged in, the dormant malware leveraged those elevated credentials to execute actions - such as modifying system files or killing services - that it previously lacked permission to perform. This explains both why the vulnerability existed undetected for a long period and why the attack was finally triggered by an administrative login event.

BThe systems administrator used a malware-infected site.

The scenario states the vulnerability was already present on the server before the administrator's session, ruling out infection introduced through a site visited during that login.

CA user kicked off the malware attack remotely to the server.

The trigger was a local administrative login event, not an independent remote user action; no evidence in the scenario supports an external party initiating the attack.

DThe company did not renew the malware license.

An expired antimalware license degrades detection capability by halting signature updates, but it does not explain a pre-existing dormant vulnerability being activated specifically by an administrative login.

Concept tested: Privilege escalation triggering dormant malware execution

Source: https://attack.mitre.org/techniques/T1068/

Topics

#privilege escalation#malware#attack vector#forensic analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SK0-004 Practice